ARP Request Trend Fitting for Detecting Malicious Activity in LAN

Abstract

Security of local area networks (LANs) attract enormous attention these days. LANs are not safe even under a well-configured firewall, because malware can be easily delivered through network applications. Thus we need to take counter measures against malicious activities by focusing on each device itself. However, we cannot adopt many of existing methods to the devices which have limited resource capacity like IoT. Accordingly, we consider that the request pattern of address resolution protocol (ARP) may provide some indicators for finding such malicious activities without putting a burden on each device. In this paper, We propose a method to detect malicious network activity by ARP monitoring. The detection method is based on a fitting model of ARP request trend. We especially focus on the destination devices of ARP request in outlier detection with the model. We made an experiment with a data of monitored ARP requests in our network. We also discuss parameter tuning and validity of the model based on three notable requirements.